Apple

Pulling Content Out Of OS X Cache.db Files

I’m not sure when, but most likely when Leopard was released, applications started storing their cache files as sqlite databases (usually named Cache.db). For example, Safari has its cache at:

~/Library/Caches/com.apple.Safari/Cache.db

Apps that haven’t caught up yet are still using the less-efficient .cache files. Though not as efficient, these files are easier to access, just toss it onto BBEdit and you can see the contents. Try doing this with a 100+MB .db file and prepare to wait.

There probably is a GUI app to extract data from .db cache files, but I’m too lazy for that. OS X has everything you need already built in so fire up Terminal.app (I’ve been playing with Visor lately) and dig into your cache:

# cd ~/Library/Caches/com.apple.Safari/
# sqlite3 Cache.db

You’ll be in the sqlite interactive mode:

sqlite> select * from cfurl_cache_response;
sqlite> select receiver_data from cfurl_cache_blob_data where entry_ID = [1234];

To output the data to a file use the following:

sqlite> .output test.html
sqlite> select receiver_data from cfurl_cache_blob_data where entry_ID = [1234];
sqlite> .exit

That should do it. Any questions? Leave a comment.

4 thoughts on “Pulling Content Out Of OS X Cache.db Files”

  1. Hi everyone,

    it didn't works….
    i delete the [ character but and it works better but I don't have the data in the output file ??!!

    Could you help me ??

    1. What OS X version are you running? Also, you should try a different query just to get SOME kind of output. Maybe "select receiver_data from cfurl_cache_blob_data;" (leaving out the WHERE altogether). Does this get you any closer?

    1. You'll probably have to save it as a text file and check the first couple lines for clues as to what type of file it is. Usually there is embedded meta-data such as PNG/PDF/JPG etc. Sorry, I can't be more specific.

Leave a Reply to Simon Cancel reply

Your email address will not be published. Required fields are marked *